A userspace WireGuard client that exposes itself as a proxy • Hacker News Board

Re: A userspace WireGuard client that exposes itself as a proxy

#31

Post by CyberRabbi » Sun, Mar 27, 2022, 2:44 AM UTC

I love wireguard but my one gripe with it is that its not a true data link layer. You have to give it routing information through an out of band mechanism “AllowedIPs.” One downside is that you can’t have two peers that act as general routers on the same wireguard network. With Ethernet, you can have multiple nodes in the same subnet acting as generic routers, it’s just a matter of sending IP packets to that host.

I hope someday wireguard addresses this issue and makes itself fully transparent as a data link layer.

Re: A userspace WireGuard client that exposes itself as a proxy

#32

Post by tormock » Sun, Mar 27, 2022, 2:49 AM UTC

WireGuard Implementation for ESP-IDF: https://github.com/trombik/esp_wireguard

Re: A userspace WireGuard client that exposes itself as a proxy

#33

Post by octeep » Sun, Mar 27, 2022, 2:56 AM UTC

warner_of_doom wrote: post #13

What about UDP?

Not yet unfortunately. I'll add it in the future, but I'm preoccupied with homework right now.

Re: A userspace WireGuard client that exposes itself as a proxy

#34

Post by tptacek » Sun, Mar 27, 2022, 2:56 AM UTC

momothereal wrote: post #29

tptacek wrote: post #25

Earlier quoted context omitted.

Neat! How does yours work? The Go version of this is easy to write, because wireguard-go has helpers to drive Netstack, which is also written in Go. But yours is in Rust. (I could have dug in, but I'm being lazy).

Sure, essentially it's a TCP and UDP server that: - receives connections and assigns a random internal port for it - wraps the data packets in a transport(TCP/UDP) packet that's routed from the internal port to the remote - wraps the transport in an IP packet that's routed from the address assigned the the proxy, and to the remote WireGuard address - wraps that with WireGuard's protocol (encryption) - sends off the e…

smoltcp! That's what I was looking for. Thanks!

Re: A userspace WireGuard client that exposes itself as a proxy

#35

Post by mercora » Sun, Mar 27, 2022, 2:56 AM UTC

CyberRabbi wrote: post #31

I love wireguard but my one gripe with it is that its not a true data link layer. You have to give it routing information through an out of band mechanism “AllowedIPs.” One downside is that you can’t have two peers that act as general routers on the same wireguard network. With Ethernet, you can have multiple nodes in the same subnet acting as generic routers, it’s just a matter of sending IP packets to that host. I…

i just wish i could control the routing via routing tables instead, making dynamic routing decisions possible without specialized software that is able to manipulate it.

Re: A userspace WireGuard client that exposes itself as a proxy

#36

Post by tptacek » Sun, Mar 27, 2022, 2:56 AM UTC

djbusby wrote: post #30

tptacek wrote: post #18

Earlier quoted context omitted.

One simple reason is that the serverside might not want to expose a shell to its clients, and instead just provide network connectivity; you can configure something like that with SSH, but it's a pain, and WireGuard is approximately as simple to set up as SSH, which is the primary reason it's so popular.

And it's crypto is "very good" (so I've heard, not an expert) And it's fast/low overhead. And yea, surprisingly easy, "just works" I lurk their maillist, seems a nice group.

It is very good, it is objectively better in a lot of ways than legacy DNS protocols. But it's popularity is, I think, mostly because of ease-of-use.

Re: A userspace WireGuard client that exposes itself as a proxy

#37

Post by tenebrisalietum » Sun, Mar 27, 2022, 2:57 AM UTC

Is this reinventing OpenVPN?

Re: A userspace WireGuard client that exposes itself as a proxy

#38

Post by jeltz » Sun, Mar 27, 2022, 3:08 AM UTC

tptacek wrote: post #24

warner_of_doom wrote: post #21

Earlier quoted context omitted.

Does this SOCKS5 tunnel support UDP?

Oh! I don't think so; at least, I don't think go-socks5 does.

SOCKS5 supports UDP, but yeah it does not look like go-socks5 does.

Re: A userspace WireGuard client that exposes itself as a proxy

#39

Post by RL_Quine » Sun, Mar 27, 2022, 3:16 AM UTC

MallocVoidstar wrote: post #22

RL_Quine wrote: post #15

Earlier quoted context omitted.

Mullvad exposes socks proxies over wireguard.

Mullvad's SOCKS proxies are only accessible if you've got the VPN active; they're an additional layer, not an alternative.

That is not true. You can route only traffic to the SOCKS proxies if you choose and nothing else.

Re: A userspace WireGuard client that exposes itself as a proxy

#40

Post by Hello71 » Sun, Mar 27, 2022, 3:20 AM UTC

tptacek wrote: post #18

TedDoesntTalk wrote: post #12

Why wouldn’t you just run ssh -D to the remote machine? The effect is the same and you don’t need wire guard or wire proxy.

One simple reason is that the serverside might not want to expose a shell to its clients, and instead just provide network connectivity; you can configure something like that with SSH, but it's a pain, and WireGuard is approximately as simple to set up as SSH, which is the primary reason it's so popular.

Is it a pain? As far as I know, all that's needed is to insert restrict,command="/sbin/nologin",port-forwarding before the user's key in authorized_keys. You can add more security by using a separate user, but individual Unix users for each client are not^W^Wshould not be necessary for security.